The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Azure Boards (work item titles, descriptions, acceptance criteria, and discussion comments) and uses this information to guide autonomous code modifications and shell command execution. A malicious user or external actor could inject instructions into a work item to compromise the repository or the development environment.
Ingestion points: Reads Azure Boards work items and comments through the Azure DevOps MCP server (mcp__azure-devops__wit_get_work_item, mcp__azure-devops__wit_list_work_item_comments) or the az CLI (az boards work-item show).
Boundary markers: The skill instructs the agent to render HTML description content to text (Phase 1), but lacks robust boundary markers or "ignore embedded instructions" warnings for the ingested content.
Capability inventory: The skill has significant capabilities, including local file modification (Edit, Write), Git operations (push, commit), Azure Repos management (az repos pr create), and execution of various build and test toolchains (npm, pytest, cargo, go, etc.).
Sanitization: There is no mention of sanitization or filtering of the work item content beyond basic HTML rendering.
[COMMAND_EXECUTION]: The skill requires a broad range of shell command permissions (allowed-tools) to maintain its stack-agnostic approach. This includes the ability to run compilers, package managers, and the Azure CLI. While the subcommands are partially narrowed (e.g., git status*), the inclusion of tools like npx *, bundle exec *, and various test runners provides a broad execution surface if the agent is influenced by malicious work item data.

ado-plan-build